Exposure Analytics - Manual Data Sources

[fraserphillips]

I'm trying to add assets and users from an index that is not apart of the standard predefined sources.   I can't  seem to get any of the fields to validate.  I've updated the props.conf from the exposure analytics app, adding in the stanza for the sourcetype from my data source.  In there I've tried a few methods to ensure the field names that i see EA looking for (nt_host, user_id, etc) are parsed out.  I verified on a basic SPL search, the field names are parsed and presented at search time.  But I can't get any fields to validate.

Is there any documentation that speaks to bringing in your own data into exposure analytics?

[henry_collins]

If the fields show up in a normal SPL search but fail validation in Exposure Analytics, it's often because EA expects those fields to exist at index time or in a specific data model, not just as search-time extractions. Double-check that your sourcetype mapping and required field names match exactly what EA expects. I don't think there's much official documentation for onboarding custom data sources, so the Splunk docs and community posts are probably your best references unless Splunk Support can share internal guidance.